fbpx

Details
Category: Cybersecurity PRISM
The first is setting up your security monitoring tools to receive raw security-relevant data (e.g. login/logoff events, persistent outbound data transfers, firewall allows/denies, etc.). This includes making sure your critical cloud and on-premises infrastructure (firewall, database server, file server, domain controller, DNS, email, web, active directory, etc.) are all sending their logs to your log management, log analytics, or SIEM tool.

Read more: 2-Most Critical Functions of An SOC

Details
Category: Cybersecurity PRISM
In order to successfully protect their systems and information, cybersecurity professionals must demonstrate a high degree of situational awareness. This type of awareness takes time to cultivate, because it usually develops through experience within a specific organization.

Read more: Situational Awareness in Cybersecurity

Details
Category: Cybersecurity PRISM
At this point, the risk of not having the ability to swiftly patch a computing environment should be obvious. Within hours of the Heartbleed bug’s release, hackers were already exploiting it. In some cases, patches were released well after hackers ferreted out the vulnerabilities. Nevertheless, time is of the essence with zero day vulnerabilities: The sooner you patch, the better.

Read more: Layered Cybersecurity is must for prevention of attacks

Details
Category: Cybersecurity PRISM
Bluetooth was originally designed by Nokia with the name Wibree in 2006, which was then later adopted by the Bluetooth Special Interest Group (SIG) in 2010.
Later on, the Bluetooth 4.0 core specification was released with the focus on designing a radio standard with low power consumption targeting use in devices with low resources, power, and bandwidth.

Read more: Bluetooth Security: What should you know to keep yourself SAFE?

Details
Category: Cybersecurity PRISM
Network Traffic Analysis is a critical piece of modern threat detection and response practices because many operational and security issues can be investigated by implementing NTA at both the network edge and the network core. With a traffic analysis tool, you can spot things like large downloads, streaming, or suspicious inbound or outbound traffic.
 

Read more: The Importance of Network Traffic Analysis in Threat Detection and Response Programs

Details
Category: Cybersecurity PRISM
Proxy Servers are referred to those servers that act as an intermediary to the request made by clients to a particular server for some services or request for some resources.

Read more: Introduction to Proxy Servers

Details
Category: Cybersecurity PRISM
Command-and-control attacks can compromise an entire network. Find out what they are and how they work.
 
Malicious network attacks have been on the rise in the last decade. One of the most damaging attacks, often executed over DNS, is accomplished through command and control, also called C2 or C&C.

Read more: Command and Control Explained

Details
Category: Cybersecurity PRISM
You should be aware of many security terms that are related to intrusion detection and prevention technologies

VULNERABILITY

A vulnerability is a weakness that compromises the security or functionality of a particular system in your network. An
example of a vulnerability is a web form on your public website that does not adequately filter inputs and guard against
improper data entry. An attacker might enter invalid characters in an attempt to corrupt the underlying database.

Read more: IPS/IDS Terminology

Details
Category: Cybersecurity PRISM
It works in the network layer of the OSI Model. It applies a set of rules (based on the contents of IP and transport header fields) on each packet and based on the outcome, decides to either forward or discard the packet.

Read more: Security threats to Packet Filters

Details
Category: Cybersecurity PRISM
The authoritative DNS server is the final holder of the IP of the domain you are looking for. When you write a domain name in your browser, a DNS query is sent to your internet service provider (ISP). The ISP has a recursive server, which might have the needed information cached in its memory. But if the data is outdated, this recursive server need to find the IP elsewhere. It will try to find it in other recursive servers, but if it can’t, it needs to get the IP address from an authoritative DNS server.

Read more: What is Authoritative DNS server?

Details
Category: Cybersecurity PRISM
Of course, to have an understanding of which problems can be solved using threat intelligence, you do first need to understand what intelligence is potentially available. During the webinar, both Dave and Chris spent some time covering the most common sources.

Read more: Threat Intelligence Sources

  1. What is ARP poisoning?
  2. Attacker Methodology
  3. Risks of the old, traditional firewalls
  4. Why playbooks belong in every agency’s cyber toolkit
  5. Where is NetFlow information available?
  6. Importance of the Audit Trail
  7. Cisco Encrypted Virtual Private Networks
  8. The Process of Access Control
  9. Cisco® Stealthwatch Cloud - A New Tool for Your Security Arsenal
  10. The Difference Between the Deep Web and Darknet

Page 26 of 27